Chapter VI: Magnetic-Stripe Cards: The Consolidating Force

The Magnetic-stripe Card System

Almost simultaneously that the retail industry underwent revolutionary changes with the introduction of bar code, the financial industry adopted magnetic-stripe card technology. What is of interest is that both bar code and magnetic-stripe card enjoyed limited exposure when they were first introduced in the late 1960s. It took at least a decade for the technologies to become widespread. Each overcame a variety of obstacles. Coupled together the two techniques were major innovations that affected the way that consumers carried out their day-to-day tasks. The technologies were complementary; on the one hand were the actual commodities consumers purchased and on the other was the means with which they purchased them. Yet, the bar code differed from magnetic-stripe card in that it was more a service offered by retailers to consumers, with the primary focus being to make business back-end operations more efficient. The magnetic-stripe card however, had a more direct and personal impact on the cardholder, as it was the individual’s responsibility to maintain it. The consumer had to carry it, use it appropriately, and was liable for it in every way. Certainly bar codes on cards were being used early on but they were far less secure than magnetic stripe cards and therefore not adopted by financial institutions. Before too long, magnetic-stripe cards became synonymous with the withdrawal of cash and the use of credit which acted to heighten the importance of the auto-ID technology. Even today, magnetic-stripe cards for financial transaction cards dominate the market.

Historical Overview

Plain card (i.e. blank paper card) issuing became popular in the 1920s when some United States retailers and petrol companies began to offer credit services to their customers. McCrindle (1990, p. 15) outlines the major developments that led to the first magnetic-stripe being added to embossed cards in 1969. “By the 1920s the idea of a credit card was gaining popularity... These were made of cardboard and engraved to provide some security... The 1930s saw the introduction of some embossed metal and plastic cards... Embossed cards could be used to imprint information on to a sales voucher... Diners Club introduced its charge card in 1950 while the first American Express cards date from the end of the 1950s.” Magnetic-stripe cards made their debut more than a decade after computer technology was introduced into the banking system in the 1950s (Mee & Daniel, 1996). Until that time computers were chiefly used for automating formerly manual calculations and financial processes rather than offering value-added benefits to bank customers (Essinger, 1999, p. 66). One of the first mass mail-outs of cards to the public was by credit card pioneer, Chuck Russell, who launched the Pittsburgh National Charge Plan. Out of the one hundred thousand cards that were sent to households about fifty per cent of them were returned, primarily because consumers did not know what to do with them or how to use them. Cash remained the preferred method of payment for some time. Armed with this experience, Russell went on to become the chairman of Visa International in the 1980s.

Historically, embossed cards had made an impact on the market, particularly on the financial services industry. Financial transaction cards (FTC) were widespread by the late 1970s and large firms that had invested heavily in embossed-character imprinting devices needed time to make technological adjustments (Bright, 1988, p. 13). Jerome Svigals (1987, p. 28f) explained the integration of the embossed card and the new magnetic-stripe as something that just had to happen: “It would take a number of years before an adequate population of magnetic-stripe readers became available and were put into use. Hence, providing both the embossing and stripe features were a transition technique. It allowed issued cards to be used in embossing devices while the magnetic-stripe devices built up their numbers.”

Today magnetic-stripe cards are still the most widely used card technology in the world, and they still have embossed characters on them for the cardholder’s name, card expiry date, and account or credit number. This is just one of many examples showing how historical events have influenced future innovations. As Svigals (1987, p. 29) noted more than twenty years ago, it is not clear when or even if, embossing will eventually be phased out. Hence, his prediction that the smart card would start its life as “...a carrier of both embossed and striped media.” These recombinations are in themselves new innovations even though they are considered interim solutions at the time of their introduction; they are a by-product of a given transition period that continues for a time longer than expected. Perhaps here also can be found the reason why so many magnetic-stripe cards still carry bar codes also. The bar code on the same card can be advantageous to the card issuer. For instance, in an application for a school it can serve a multifunctional purpose: the bar code can be used for a low risk application such as in the borrowing of books, the magnetic-stripe card in holding student numbers, and the embossing can also be used for back up if on-line systems fail.

Essinger (1999, p. 80) describes this phenomenon by describing technology as being in a constant state of change. No sooner has a major new innovation been introduced than yet another incremental change causes a more powerful, functional, and flexible innovation to be born. Essinger uses the example of the magnetic-stripe card and subsequent smart card developments, cautioning however, that one should not commit the “cardinal sin of being carried away by the excitement of new technology and not stopping to pause to ask whether there is a market for it.” He writes (1999, p. 80) “what matters is not the inherent sophistication of technology but the usefulness it offers to customers and, in extension, the commercial advantage it provides”.

Magnetic-Stripe Card System

Encoding the Magnetic-strip

The magnetic stripe technology had its beginnings during World War II (Svigals, 1987, p. 170). Magnetic-stripe cards are composed of a core material such as paper, polyester or PVC. Typically, plastic card printers use either thermal transfer or dye sublimation technology. The advantage of dye sublimation over thermal transfer is the millions of colors that can be created by heat intensity. If color is required by the operator on both sides then one side of the card is colored first before the other but this is expensive. The process as outlined on a manufacturer’s web page is quite basic (Eltron, 1998): “...you simply insert the ribbon and fill the card feeder. From there, the cards are pulled from the card feeder to the print head with rollers. When using a 5 panel color ribbon the card will pass under the print head and back up for another pass 5 times. When all the printing is complete, the card is then ejected and falls into the card hopper.”

Finally, the magnetic-strip (similar to that of conventional audio tapes) is applied to the card and a small film of laminated patches is overlaid. The magnetic-strip itself is typically gamma ferric oxide “...made of tiny needle-shaped particles dispersed in a binder on a flexible substrate” (Zoreda & Oton, 1994, p. 16). The strip is divided laterally into three tracks, each track designed for differing functions (Table 1). Track 1 developed by IATA, is used for transactions where a database requires to be accessed such as an airline reservation. Track 2, developed by the ABA contains account or identification number(s). This track is commonly used for access control applications and is written to before the card is dispatched to the cardholder so that every time it is presented it is first interrogated by the card reading device. As Bright (1988, p. 14) explains: “...[t]he contents, including the cardholder’s account number, are transferred directly to the card issuer’s computer centre for identification and verification purposes. This on-line process enables the centre to confirm or deny the terminal’s response to the presenter...” Finally, Track 3 is used for applications that require data to be updated with each transaction. It was introduced some time after Tracks 1 and 2. It contains an encoded version of the personal identity number (PIN) that is private to each individual card. The cardholder must key in the PIN at a terminal that is then compared with the PIN verification value (PVV) to verify a correct match.

Each magnetic-stripe card is magnetically encoded with a unique identification number. This unique number is represented in binary on the strip. This is known as biphase encodation. When the strip is queried, the 1s and 0s are sent to the controller in their native format and converted for visual display only into decimal digits. When magnetic-stripe cards are manufactured they do not have any specific polarity. Data is encoded by creating a sequence of polarized vertical positions along the stripe. An important concept in understanding how tracks are triggered to change polarity is coercivity (measured in Oersted, Oe). This can be defined as the amount of magnetic energy or solenoid required which can be broadly defined as low (about 300 Oe) and high (3000-4000 Oe). Most ATM cards are said to have low coercivity (loco) while access control cards have high coercivity (hico) to protect against accidental erasure. Here is one reason why embossed account numbers still appear on ATM or credit cards; if the card has been damaged, information can be manually retrieved and identified (from the front of the card) while the replacement card is dispatched.

Mercury Security Corporation (1998) explain this process in more detail: “[t]he magnetic media is divided into small areas with alternating polarization; the first area has North/South polarization, and the next has South/North, etc. In order to record each “0” and “1” bit in this format, a pattern of “flux” (or polarity) changes is created on the stripe. In a 75bpi (bits per inch) format, each bit takes up 1/75th (0.0133) of an inch. For each 0.0133” unit of measure, if there is one flux change, then a zero bit is recorded. If two flux changes occur in the 0.0133” area, then a one bit is recorded.” When choosing a magnetic-stripe card for an application the following issues should be taken into consideration. First, should the magnetic-stripe be loco or hico. Hico stripes can typically withstand 10 times the magnetic field strength of loco stripes. Most stripes today are hico so that they are not damaged by heat or exposure to sunlight and by other magnets. Second, which track should the application use to encode data, track one, two or three. One should be guided by ANSI/ISO standards here that recommend particular applications to particular tracks. Other considerations include whether the card requires lamination, to be embossed or watermarked and whether the card will follow ISO card dimensions. The cost of the card chosen should also be considered as it can vary significantly.

Automated Teller Machines (ATMs)

An automated teller machine is an unattended computer which is located in a public space, accessible twenty-four hours a day, and seven days a week by bank customers (Figure 1). The electronic machine is connected to a data network and other peripheral devices and activated by a consumer to obtain transaction information in the form of mini-statements, to deposit or to make a withdrawal of cash, or to make a basic enquiry about their account(s). Don Wetzel is credited as the inventor of the ‘networked’ ATM. He created the machine while working for the Docutel Company in Dallas, Texas, during the 1960s. Today there are more than 1.5 million ATMs worldwide. ATMs are always positioned in a convenient location close to banks, shopping centers, petrol stations or where large numbers of people congregate. ATM installations are considered to be located either on premises or off premises. On premise ATMs are usually more advanced and offer a range of services just like a customer would enjoy in a bank branch. Off premise ATMs are cheaper models which serve the primary purpose of allowing customers to withdraw cash.

Hardware and Software

An ATM is much like a standard computer, although historically ATMs had custom hardware architectures using microcontrollers. A modern ATM has a central processing unit (CPU) that controls the user interface and handles transaction requests. It has a display that the customer reads when making a transaction in order to follow simple commands. Customers enter details such as a PIN, the amount of cash to be withdrawn using a dedicated PIN pad and access special features through function key buttons (e.g. OK and Cancel). Customers insert their magnetic-stripe card into a card reader, and also can request a printout of a receipt or specialized transactional query. The ATM uses a cash dispenser to provide the money to the customer. When a transaction is complete, typically, the user will receive their card back first, then they can receive their cash, then finally a printout of their receipt. Some ATMs have features like voice commands, useful for the blind or are housed in sunken units to help shorter persons. What makes ATMs different to computers is a purpose-built secure cryptoprocessor and vault which is not accessible to the general public. Mechanisms in the vault ay include: dispensing, deposit, security sensors, and locks. Most vaults are attached to the ground so they cannot be stolen. The operating systems utilized on ATMs are again similar to those available in standard computers. ATM applications built on these standard operating systems (eg Microsoft Windows) are vulnerable to the same attacks, as those in computers. Common application layer transaction protocols include Diebold 912, IBM PBM, and NCR NDC.

Networks

ATMs are directly linked to an ATM Transaction Processor via a network link such as a leased line. Dial-up modems have traditionally been used in the past but with increasing bandwidth, leased lines are used because they establish a connection faster. In Australia for instance, the cost of leasing an E1 (i.e. 2 Mbps made up of 32 channels at 64 Kbps) is still expensive, so the promise of high-speed Internet Virtual Private Networks (VPNs) are solutions that customers are demanding from banks. It is not uncommon still to find ATMs in developing countries that use lower-level layer communication protocols to communicate back to the bank such as X.25 and Frame Relay. The Secure Socket Layer (SSL) protocol is used to encrypt information going between the ATM and the ATM Transaction Processor to ensure that all transaction information remains secure.

Security

Given ATMs are located in a public space, physical security of the actual machine is paramount. Ram-raids are not unheard of, and are an attempt for thieves to crash into the ATM and literally carry it away with them using a heavy vehicle. ATMs can also be subject to tampering, surveillance by professional fraudsters, and other problems. Essinger (1999, pp. 162f) is correct in highlighting that cardholders need to adhere to the bank’s instructions of never writing a PIN down. However recent attacks against magnetic-stripe cards have focused on using tiny secret cameras or other equipment to steal cardholder PINs as they are entering them onto the ATM keypad (Smith, 2002, p. 3). In 1994, fraud on Visa was about 0.4 per cent of total credit card transactions (Harris, 1994). By 2005, this figure had grown to 0.7 per cent, much higher when one considers that the number of credit card transactions had also increased substantially overall.

Personal information is secured using Triple DES encryption in most cases to ensure that transactional integrity is enforced. Alarm sensors are also located within the ATM itself to alert operators when illegal access has occurred. Security surveillance cameras are usually located near ATMs, recording consumer behavior. In some countries, like Chile and the Philippines, security guards stand watch over ATMs.

Card Processing

So magnetic stripe cards are issued by financial institutions and can be used to withdraw money or when a customer pays for products or services with a credit card. In the latter case, the card information needs to be recorded either manually, using a card imprinter or at a point of sale (POS) terminal which is then verified so that the merchant can ensure that they receive payment. Typically in any credit transaction there are five stakeholder types: the cardholder, merchant, acquirer, card association and issuer. The cardholder owns the card which is used to make a purchase. The issuer is the financial institution that issued the credit card to the cardholder. The merchant is the business accepting the credit card payment for particular goods or services sold to the cardholder. Now for a consumer to purchase a product with a credit card, a card processing service needs to be made available to a merchant via a financial institution, known as the acquirer in this context. A card association, such as VISA or MasterCard, acts as a gateway between the acquirer and issuer to authorize and fund a given transaction. The flow of information and money between the stakeholders is known as the process of interchange and involves the following steps: authorization, batching, clearing and settlement, and funding (Hendry, 2007).

Magnetic-stripe Drawbacks

The durability of magnetic-stripe cards often comes into question: “[m]agnetic stripes can be damaged by exposure to foreign magnetic fields, from electric currents or magnetized objects, even a bunch of keys” (Cohen, 1994, p. 27). This is one reason why so many operators have expiry dates on cards they issue. According to Svigals (1987, p. 185), “[m]agnetic stripes have been tested and are generally specified to a two-year product life by the card technology standards working groups.” Another drawback is that once a magnetic-stripe has been damaged, data recovery is impossible (Cohen, 1994, p. 29). Another way that a magnetic-stripe card can be worn out is if it has been read too many times by a reader. The read head has a small surface window, known as the field of view, that comes into direct contact with the magnetic-stripe. When a card is passed through or inserted in a reader a read head generates a series of electrical pulses. These alternating voltages correspond to alternating polarities on the magnetic-stripe. Per bit length, the reader counts the changes in polarity that are then decoded by the reader’s electronics to recover the information that is hidden on the card.

Svigals (1987, p. 36) is more explicit in describing the limitations of magnetic-stripe by writing that “[m]ost knowledgeable tape experts readily admit that the magnetic stripe content is: readable, alterable, modifiable, replaceable, refreshable, skimmable, counterfeitable, erasable, simulatable.” Jose and Oton (1994, p. 20) identify the primary methods of magnetic-stripe fraud as being theft, counterfeit, buffering, and skimming. The magnetic-stripe has rewrite capability and data capacity ranges from 49-300 characters. The latter is clearly a handicap when a chosen application(s) requires the addition of new data or features. While linear bar codes are even more limited, magnetic-stripe may still not be the right solution for a given service. Another issue that requires some attention is security. As Bright explains (1998, p. 15): “[t]he primary problem may be described with one word ‘passivity’; lacking any above board intelligence, the magnetic stripe card must rely on an external source to conduct the positive checking/authentication of the card and its holder. This exposes the system to attack. The scale of the problem exacerbated by the relative ease of obtaining a suitable device with which to read and amend the data stored in the stripe.” Consider the case in the United Kingdom were hundreds of cards were skimmed at Shell Service stations in 2006. While the UK press claimed that it was the EMV card that criminals were targeting, it was in fact the older EMV magnetic-stripe cards that were vulnerable to the attack (Aconite, 2006). There are however, numerous innovators that continue to believe that magnetic-stripe technology still has a future and they are researching means to make the technology more secure.

THE MAGNETIC-STRIPE CARD INNOVATION SYSTEM

Retail and Banking Associations Join Forces

The rise of the magnetic-stripe card, as we know it today, can be attributed to the collaborative efforts between the banking and transport associations, namely the American Banking Association (ABA) and the International Air Transport Association (IATA). It is commonly stated that an American National Standards Institute (ANSI) publication in 1973, developed jointly by ABA and IATA for a plastic credit card with a magnetic-stripe, laid the foundations for widespread diffusion. By banding together, the two associations were able to present a positive case for standardization. Banking and transport are two broad application areas that affect the masses, so the influence of the organizations on the direction of the magnetic-stripe card cannot be underestimated. Early on however, magnetic-stripe technology like bar code was hampered by a lack of standards: “[a]s has so often been the case with the commercialization of new ideas, one of the delaying factors was the absence of recognized international standards during its early existence” (Bright, 1988, p. 14). ISO finally resolved this issue through its Technical Committee for information processing standards (TC 97). International Standards (IS) 7810 and 7811 were published outlining definitions about the physical dimensions of the magnetic-stripe card, embossing, layout and reading requirements. Magnetic-stripe can boast a 35 year stockpile of documentation. ISO and ANSI have published a plethora of information on the topic, together with IATA and ABA. With input from the IATA, ABA and the Thrift industry, specific tracks were defined on the magnetic-stripe for specific uses. Track 2 for instance, reserved for banking applications, contained a field for the primary account number (PAN) of 19 digits. Another field for additional data such as the expiration date (4 digits) of the card, restriction or type (3 digits), offset or PVV (5 digits) or discretionary data is available, as well as control characters for the start and end sentinel, field separator and redundancy check character.

From Exclusivity to Interoperability

Solutions for magnetic-stripe cards based on proprietary schemes were initially used strategically by banks and other companies to secure a loyal customer base. Cash dispensers were not plentiful initially, so banks were able to attract customers by being the first to market. Louderbacker (1980, p. 40) recounts that one of the first cash dispensers was installed by the Chemical Bank in New York City in 1969. By early 1970, other banks began planning for full-service ATM (Automatic Teller Machine) installations. By the late 1970s bank card technology became a mechanism for differentiating financial institutions. If a bank was able to offer the card linked to its existing portfolio of services it was considered technologically advanced. Egner (1991, p. 56) wrote that ATM services were exclusive, and institutions like Citibank were actually able to shift market share by their promotion. The same could be said for Barclays Bank in the UK. According to Essinger (1999, pp. 172-173), the United Kingdom’s first cash dispensers were installed by Barclay’s bank in 1967 and branded Barclaycash. “They were not strictly speaking ATMs, as their function was restricted to providing cash. They were only open for limited periods in the day and were off-line (i.e. not connected to the central computer in real time)… The first implementation in the UK of a machine which was recognizably an… ATM rather than simply a cash dispenser is regarded as having taken place on 30 June 1975”.

There was often friction between the major bank players who had reaped the rewards for taking the risk with the new technology versus the banking association that wished to exercise authority on behalf of all the other (and in most cases smaller) banks to make it a level playing field. In fact Citibank, so protective of its market share, vehemently challenged magnetic-stripe standardization. Yet the bank soon realized that if it did not commit to the changes that it would be left behind, eventually becoming the minority. In essence, what Citibank and others in a similar position were afraid of was losing their competitive advantage to interoperability. Interoperability “…[r]elates to a situation whereby a card issued by one organization, e.g. a bank, can be used in an ATM belonging to another” (Bright, 1988, p. 15). Today most major service provider’s cards can be used in each others’ ATMs. In Australia customers were only able to access funds from the ATMs of different banks in 1992. The National Bank’s corporate affairs manager was quoted as saying: “[t]he attitude of the 1980s has certainly changed for the better and it’s only a matter of time before a uniform system comes into being” (Daily Telegraph, 1992).

Today, banks across the world have forged stronger relationships, as can be seen by international ATM sharing schemes (Essinger, 1999, p. 160). And all this is possible because of the PAN that is defined in Track 2 of the magnetic stripe. All PANs contain an industry code for the issuer (1 digit), an issuer identification (5 digits), customer identification (12 digits) and check digit. It was this very field that enabled different banks to accept magnetic-stripe cards at ATMs, regardless the operator. The PAN can identify the card issuer and cardholder, thus making interoperability possible via advanced card readers. It is important to note, that not all applications require a standardized magnetic-stripe card format, especially for ‘closed’ systems like amusement parks. In fact there are some instances when a non-ISO design would be more appropriate, acting to increase security by non-conformity. This usually makes counterfeiting or fraudulent alterations to the card difficult (Mullen & Sheppard, 1998, p. 1).

The ATM Economic Infrastructure

As ATM machines began to sprout up all over North America and the UK in the 1980s, a physical infrastructure began to grow to support the banking sector. It should be noted however that this infrastructure was very expensive and it took about 16 years for the first one hundred thousand ATMs to be installed. First and foremost, magnetic-stripe cards without ATMs were almost entirely useless: “[i]mprovements in card technology would not be particularly valuable without reader technology” (Browne & Cronin, 1996, p. 102). Second, internal bank equipment needed to be able to communicate with ATMs. A physical network was required for this to become possible, and telecommunication data providers quickly sought these opportunities as they became available using protocols such as X.25. Here is perhaps one reason why smart cards have not yet replaced magnetic-stripe cards in North America- the physical infrastructure in terms of the installed base of ATMs and POS equipment kept growing and growing throughout the 1990s. For instance, in 1997, NCR installed three thousand units (ATMs) in just 150 days for Banc One (Korala & Basham, 1999, p. 6-7).

In the 1970s and 1980s ATM volumes boomed but in the 1990s manufacturers turned their attention to adding POS functionality (Mitchell, 1996, p. 57). In some parts of the world like the United States, Japan and Hong Kong large investments in magnetic-stripe equipment have tied card issuing organizations to the technology. Apart from the initial investment it should also be considered that ATMs also incur ongoing rental space costs (Godin, 1995, p. 178). Weighing up the total potential losses as a direct result of fraud and other drawbacks of magnetic-stripe cards, against the potential multi-million dollar investment of upgrading readers and writers for smart cards worldwide; one is able to understand how physical infrastructure directly affects innovations. Smart cards are also more complicated to produce and need more expertise than magnetic-stripe. And the more complicated the production process, the harder it is produce large quantities. Murphy (1996, p. 82) outlines the intricate process by which one can only assume that the person in charge must have acquired some first hand experience previously. “Converting to smart card production is no easy task. Not only does a company need state-of-the-art printing presses, it must upgrade its plastics to a thickness that can accommodate the computer chip that makes a smart card ‘smart,’ as well as ensure the cards are temperature resilient; it needs special machines to drill holes for the chips, and another set of machines to place computer chips in those holes…” Economies of scale are necessary here.

The Global Inter-bank Network

The success of magnetic-stripe card technology can be measured by the increasing need for the interconnection of thousands of banks across every continent in the world. Colton and Kraemer (1980, pp. 22-23) list some of the major centralized network operations. “Federal Reserve System (FedWire) manages Federal reserve banks across the US interconnecting 275 banks; Clearinghouse Interbank Payment System (CHIPS) has the capability to execute international transactions among 62 financial institutions in New York; interbank switching in Japan is provided by Zenginkyo and the National Cash Service (NCS) network systems; the UK clearing banks have formed a company called Bankers Automated Clearing Services (BACS); Society for Worldwide International Financial Telecommunications (SWIFT) links more than 239 banks.”

SWIFT stands for the Society for World-wide Interbank Financial Telecommunications. It was established in 1973, and by 1984 it enveloped 1,104 banks in 49 countries (Dean, 1984). Dean’s article on the cashless society raises ethical issues about the power of an organization like SWIFT (see also Kirkman, 1987, pp. 224-227). As of November 2008, the SWIFTNet FIN network had corporate customers from 209 countries on its network, 2,272 full members, 3,303 sub-members, 3,146 participants and 8,721 live users. The users are typically banking organizations, securities institutions or private enterprise and exchange millions of standardized financial messages every day (SWIFT, 2008). SWIFT believes that its role is two-fold. First they provide a proprietary communications platform, products and services that allow their customers to exchange financial information securely and reliably. Second, they act as a hub to bring the financial community together to work towards defining standards and mutually beneficial financial solutions.

One can only begin to guesstimate the number of agreements that are in place between so many different entities to allow it all to work properly. This kind of meshed structure cannot be established instantaneously but only after years of formal exchanges. The European Union is another example of inter-bank data transfer standardization that requires thousands of banks to agree on a particular type of electronic payment system (EPS) that goes beyond even SWIFT (Central Banks, 1989, p. 102; Radu, 2002). Of course to understand the extent of sharing, of not only data but of physical resources such as ATMs, one must consider the networks of the large credit card and banking associations of Visa, MasterCard, Cirrus, PLUS, GlobalAccess, ATM™, AutoCash. What is worthy of noting here is the support structure that has been built around the magnetic-stripe functionality, i.e. being able to withdraw, deposit and transfer funds almost anywhere in the world. Without this infrastructure in place, the magnetic-stripe card would not have become as prolific as it has. Brands like Visa and Mastercard would not have had in excess of twenty million members each.

Calculated Social Change

“Twenty-five years ago, the very idea of going to a machine in order to withdraw money from a bank seemed outlandishly fanciful. Yet, with the rapidity so often associated with technological change, it soon became just another part of everyday life” (Korala & Basham, 1999, p. 6-1). The same could be said for Electronic Funds Transfer at Point of Sale (EFTPOS) (Figure 2). Numerous business people were convinced during the mid 1980s that EFTPOS would be an unsuccessful application and yet it is increasingly being used today (Essinger, 1999, p. 9). It is important to note however, that while change was “rapid”, it still took a considerable amount of time for end-users to come to terms with the fact that they did not have to physically enter a branch to withdraw money. Essinger regards ATMs to be the “[m]ost visible, and perhaps most revolutionary, element of the virtual banking revolution” (Essinger, 1999, p. 159). He believes that ATMs changed the way we lived forever and that every day throughout the world millions of people in thousands of walks of life rely on the convenience of the cash machines to gain access to money.

Governments across the globe committed resources to investigating the potential impact of the technical change of ATMs, EFT, and EFTPOS. In Australia, a Technological Change Committee investigated the possible changes EFT would initiate (ASTEC, 1986). One of the earliest EFT trials in Australia was conducted in 1982 between the Whyalla Credit Union and the G.J. Coles Company (S.A. Council of Technology, 1983, pp. 21-25). The government had a role to play in regulating EFT transactions but before doing so it had to ensure that it had adequately researched the implications of the new technology. Worldwide studies were also conducted on EFT by the OECD in particular (OECD, 1989; Revell, 1983, pp. 108-110).

As in the case of bar code, labor unions and other groups were again quick to point out that the automation would mean job losses for bank staff. The technology appealed more to the needs of business, as they sought ways to operate more efficiently. Learning about consumer spending habits through transaction history records was also important. Both banks and retailers saw the advantages that had to be gained by using financial transaction cards. Speed and security were among the most important attributes. Retailers also saw a reduction in the amount of cash-on-hand they required to handle. Many bank branches have been closed as a result of the automation and face-to-face over the counter staff numbers have been significantly reduced, driving consumers to change their habits for the sake of minimizing bank fees and charges. Stephen Bennett (1995, p. 10) a senior manager with KPMG wrote: “[e]lectronic transactions are considerably more cost effective than the counter based equivalent. This led to banks in the U.S. charging fees for branch based transactions and providing “free” transactions via telephone, ATM’s and EFTPOS, a concept that is now being embraced in Australia.”

As part of their marketing campaign in the 1970s credit companies mailed out plastic cards to consumers and in the early 1980s banks mailed out magnetic-stripe cards to prospective cardholders. For many of the recipients, it was unclear what added benefit the card could provide, although this was later realized. Essinger (1999, p. 8) wrote: “…it is likely that the availability of the new technology, and the fact that someone had decided to create it, is what is determining the application, rather than the customer need for it. In effect, after the invention has been put on the market, the customer demand is created for it.” He continues by pointing out that “…the cash machine was not an instant success; people needed to get used to the idea. However, once they had, the cash machine rapidly became an essential part of the customer service armory of any bank…” (p. 68).

Big Brother and the Privacy Invasion

At the time, some consumers believed that the new magnetic-stripe technology would eventually lead to breaches in privacy, especially by government agencies. Watts (1997) highlights that breaches in privacy have more to do with government outsourcing contracts than auto-ID itself. For a comprehensive overview of issues such as those related to the invasion of privacy see Rothfeder (1995, pp. 152-162), Colton and Kraemer (1980, pp. 28-30), Campbell et al. (1994), Wacks (1993), Tucker (1992), Young (1978), Federal Department of Communications and Justice in Canada (1974), Madgwick and Smythe (1974) and Cowen (1972). The rise of magnetic-stripe cards coincided with numerous Big Brother predictions made by Orwell and others. Compare Will’s The Big Brother Society (1983) with ‘Big Brotherdom has benefits’ (MIS, 1994, p. 80): “[i]t is a mistake to believe that the information supplied to such public and private organizations, or to the tax commissioner or to your employer, is your property…” Other authors that reference the term ‘big brother’ as related to auto-ID include: Thompson (1997), Andersen (1995), Conolly (1995), Martin (1995), Privacy Committee of NSW (1995), Smith (1995a), Vincent (1995), Crosby (1994), Stix (1994), Davies (1992; 1996), Hogarth (1987), Donelly (1986). It was also at this stage of the magnetic-stripe card product lifecycle, that many countries across the globe formulated Privacy Acts. Citizen identity cards were also a topical issue in which civil libertarians became involved. The Australia Card debate is a fascinating case to reflect on (Clarke, 1987; Greenleaf, 1988).[i]

There are still people today who refuse to use plastic cards to make any sort of transactions, though it is becoming more and more difficult for them to continue this practice. The younger generations, who have been brought up surrounded by technology like the Internet are far less cynical about technology in general. Internet banking (Yan, Paradi & Bhargava, 1997, pp. 275-284) has been adopted by a technology-savvy population that appreciates the convenience of banking from anywhere/ anytime. There is now an established customer base with which to leap into the new-age authentic cashless society (Egner, 1991, pp. 105-109; Husemann, 1999; Smith, 1998). Some countries like Singapore disclosed their agenda to abandon cash by the year 2000, thus preparing all consumers for the change, even though this has not obviously eventuated as yet. “In France, an agreement has been signed that forms the basis of a nationwide, electronic replacement for cash” (O’Sullivan, 1997, p. 57; Fisher, 1996, Pope, 1990). While the cashless society is not completely here yet, many countries and consumers have made substantial inroads into the virtual world. According to most it is just a matter of time.

A Patchwork of Statutes

Current laws worldwide have lagged behind technological innovation. US privacy law, for instance, has been developed in a piecemeal fashion and in a case-by-case mode. It is little wonder that some types of personal information that have been enabled mostly by auto-ID techniques, such as supermarket transaction records, are still unprotected (Barr et al., 1997, p. 75). As can be seen from Table 2, U.S. privacy-related laws are a patchwork of statutes addressing specific areas and specific types of data. There is, however, no structure or governing authority in place to enforce these statutes. This means that not only can laws vary between states but with respect to the global arena, laws in other countries are also disparate, if existent at all. A similar problem is faced in Australia. Harris (1994) reported that “[t]he Australian Federal Police Association (AFPA) [was] calling for national legislation to curb credit card fraud… [as] officials find themselves virtually powerless…” In 1994, counterfeit cards accounted for $US260 million of credit card fraud worldwide, i.e. one quarter of the world’s credit card fraud. Cornford (1995) reported that Australian “[f]ederal police fear that our laws are inadequate to deal with this type of crime. The Indonesian criminal caught with the card encoder was set free on a legal technicality. Two Americans who used counterfeit cards to steal $250,000 and then sent it back to the US could be charged only with illegal transfer… A Malaysian is awaiting trial after being arrested with 77 counterfeit Visa cards. A Hong Kong criminal was jailed for nine months after using three counterfeit credit cards to get $40,000 in Sydney… The Chinese Public Security Bureau raided factories in Beijing and Shantau, which together made more than 110,000 counterfeit Visa and MasterCard holograms.”

Consider the case where a traveler to a foreign country had their credit card stolen and misused by a perpetrator. Where does the liability lie- with the traveler, with the credit card company, with the perpetrator? “In most national jurisdictions, once the customer has notified the bank of the loss or theft, the customer is then no longer liable for any withdrawals made by a third party, although sometimes the liability remains if the customer has disclosed the PIN to somebody else” (Essinger, 1999, p. 27). Whatever the perspective, for those unfortunate persons who have found themselves in this predicament (and these are not isolated incidences) the experience can be daunting as they attempt to gather evidence.

Regulation E

Regulation E implements the Electronic Fund Transfer Act (EFTA). The act and regulation cover the following consumer electronic funds transfer systems: ATM, POS, automated clearinghouse, telephone bill-payment system, or remote banking programs. Regulation E provides the rules that restrict unsolicited issuance of ATM cards, the need for financial institutions to disclose terms and conditions of EFT services, the provision for receipts and account statements to be given to cardholders, limitations in consumer liability in the case of unauthorized transfers and procedures for error resolution. It has to be said, that most consumers do not consider the implications of Regulation E, until they fall victim to unauthorized transfers or disputes in banking errors (FDIC, 2008).

In the U.S. there is no law governing electronic payments; these aspects are covered by provisions in the Civil Code (Central Banks, 1989, p. 217). Regulation E under the Electronic Funds Transfer Act of 1978 does not include check guarantee and authorization services, transmission of data between banks and any transaction that is about the purchase or sale of securities (Scott, M.D., 1994, p. 497). Canada has also followed the United States by setting up a voluntary code of practice for debit card issuers, retailers, and consumer associations, as well as the federal and provincial regulatory bodies. In 1992 the code for Consumer Debit Card Services was introduced by the Canadian Bankers Association (CBA). However, it would be essential to remember, “[t]he code applies only to services which use debit cards and personal identification numbers (PINs) to access automated banking machines and point of sale terminals in Canada. It does not apply to cross-border transactions. The code establishes a code of practice for the issuance, use, and security of PINs. It sets the general requirements for cardholder agreements, transaction records, and transaction security, and is intended to set a minimum standard which participating organizations meet or exceed. It does not preclude protection given by other laws and standards. The code deals with the theft, fraud, technical malfunction, and other losses, and requires card issuers to establish fair and timely procedures for resolving disputes” (Campbell, 1994, p. 44).

Numerous associations have endorsed the code. The most prominent members include: the Canadian Payments Association, the Trust Companies Association of Canada, Credit Union Central of Canada, Retail Council of Canada, Canadian Federation of Independent Business and Consumers’ Association Canada. Other innovations like EFTPOS require long-term commitments to improvements to rules and regulations if they are to continually evolve to meet the needs of the end-user and withstand the test of time. The Commonwealth of Australia wrote a detailed report on the rights and obligations of users and providers of EFT systems in 1986, however much of what was documented was voluntary codes of practice like in the case of Canada and the United States.

In a recent article by Geva (2006), three topics are explored on the common theme of changes in the law due to the developments in electronic banking. These topics include: checks, payment cards, and securities transfers. Checks once considered purely paper-based payment systems are now being transmitted either in whole or in part, electronically. This process is called check truncation. The question of whether checks are now recognized under Regulation E is discussed by Geva, as are other more advanced devices used for payment.

Incremental Innovations

A number of incremental innovations to the basic magnetic-stripe card have been introduced since its inception (Ross, 2003). Developers in magnetic-stripe have primarily aimed to increase basic track capacity and protect data content with some form of encryption (Smith et al., 1996). While some of these improvements are theoretically possible many hold that the widespread introduction of these techniques is not economically viable and not worth pursuing. Consider the example of Washington University’s Magnetics and Information Science Centre (MISC) that has discovered a way of protecting the magnetic-stripe card against fraud. “The biggest expense of deploying Magneprint will be replacing or modifying card readers so they can read the magnetic wave patterns” (Stroud, 1998, p. 2). This is not to discount the efforts of MISC or other commercial manufacturers.

There is evidence to suggest that companies are still investing R&D dollars into magnetic-stripe. For example refer to the new developments listed by IPC (2001). Other experts, particularly those in smart card, believe that the costs of delivering projected magnetic-stripe innovations are too high and fall short when compared to smart card solutions which are already proven and on offer now. Svigals (1987, p. 146) predicted that if smart card was to replace magnetic-stripe cards that “...the economic and functional break-even point might be reached within a five-year period.” Svigals did not believe that the incremental density changes to the magnetics would come close to even challenging the advantages of the smart card. Yet these and other predictions made in the late 1980s and early 1990s have not eventuated and those that were quick to publicize the demise of the magnetic-stripe card have been left wondering where things went wrong.

It is true that smart card has now reached economies-of-scale and is becoming more affordable but this does not necessarily equate to the total extinction of magnetic-stripe (Nickel, 1999, pp. 1-2; Holland, 2004). Even Svigals (1987, p. 175f) himself, acknowledged that: “[a]ll evidence suggests that the magnetic-stripe FTC will have a place in the future. A financial institution with a static market, a significant investment in magnetic-stripe work stations, a very low card acceptance rate and/or rapid customer turnover, and little prospect of additional types of electronic services will probably stay with the magnetic-stripe FTC... At the other end of the spectrum is the institution with a large stable of aggressive magnetic-stripe FTC users, a fast-growing range of electronic services, an increasing set of interchange and sharing arrangements, and a growing concern about magnetic-stripe-based losses and frauds. That institution will take an early look at Smart Cards... In between the two extremes are the majority of institutions... In the final analysis, an active effort to accommodate both types of financial transaction cards appears to be the appropriate action path” (Svigals, 1987, p. 175f). In the case of the current global EMV migration, some regions have been slow to take-up the new chip and pin card. Analysts have noted that the slow uptake has been due to the complexity of replacing the entire card and terminal base, coupled with changes to the networks and bank issuer systems to deal with processing requirements (Aconite, 2006, p. 12). Fraudsters can still continue to target EMV cards, so long as the magnetic stripe is present on the back.

The new-found relationship between the magnetic-stripe and biometrics techniques has also opened a plethora of new opportunities for the technology. The University of Kent began to conduct research on encoding facial images on blocks of data small enough to fit on a magnetic-stripe in (Middleton, 1998). In addition manufacturers of numerous auto-ID devices have even seen a possible convergence between the bar code, magnetic-stripe and integrated circuit (IC) onto the one device (de Bruyne, 1990; Magbar, 2000).

Collaborative Research

Together with firms and standards-setting organizations, universities are also investing research dollars in developing further magnetic-stripe innovations, admittedly however many of these projects are sponsored. Yet it is firms that are generally more overprotective about their intellectual property (IP). But as Bright (1988, p. 136) does rightly point out, the reluctance on the part of potential suppliers to disclose their techniques and progress is understandable, granted the commercial sensitivity. Even universities, that were once considered fairly open institutions, have now jumped on the commercialization bandwagon, in order to attract even bigger funding opportunities to support laboratories and centers. For instance, MISC has developed MAGNEprint to increase the security of magnetic-stripe technology. Previously, this had been one of the technology’s technical limitations, making smart card technology more favorable for access control applications (Magneprint, 1999; Batterson, 2002): “Researchers at Washington University have invented a method for the positive identification of any piece of magnetic recording medium. The innovation permits a reading device to verify the authenticity of a document bearing magnetically recorded information, and to reject unauthorized copies... The innovation eliminates all types of magnetic fraud.” This innovation can now be implemented by manufacturers of magnetic-stripe cards to increase the attractiveness of magnetic-stripe technology compared to other card technologies. The innovation was first presented at a number of technical forums. Thereafter an article was published in a recognized journal and in 1993 became protected through worldwide patenting. With further trials conducted the university licensed Magneprint to Mag-Tek Incorporated, a firm that makes electronic readers (Stroud, 1998, p. 1). This is yet another sign that the technique is continuing to evolve and will continue to meet the needs of a variety of applications.

MAGNETIC-STRIPE CARD APPLICATIONS

Overview

Financial Transaction Cards

A cursory glance at the content of one’s wallet will reaffirm why “[f]inancial cards are by far the main application of magnetic stripe cards” (Zoreda & Oton, 1994, p. 20). The finance sector, have been responsible for the FTC explosion in the form of debit and credit cards which have paved the way towards an evolving cashless society.[ii] The two types of cards differ in that debit cards require the cardholder to enter a personal identification number (PIN) at unsupervised terminals (known as automatic teller machines ATMs) whereas credit cards only require signature verification at supervised terminals (known as electronic funds transfer at point of sale EFTPOS). Financial transactions can even be carried out from the home using a PC (personal computer) or a touchtone telephone. For the present however, ATMs and EFT terminals can be viewed as the most popular complementary innovations to magnetic-stripe cards that have changed the face of banking. For instance, between 1990 and 1994 the number of EFTPOS transactions worldwide increased from 61 million to 245 million (Federal Bureau of Consumer Affairs, 1995, p. 6). In the same period EFTPOS terminals grew annually at a rate of 38 per cent as compared to ATM terminals which only experienced an annual growth of 4 per cent. The trends as identified by Tren (1995, p. 42) can be attributed to the early adoption of ATMs by North America, Canada and Japan versus the adoption of EFTPOS by European countries to handle multi-currency payments.

Wallets Bulging with Plastic not Cash

The magnetic-stripe card was heralded as the technology that would see an end to the large bulging wallet containing copper coins and paper money (Johnstone, 1999).For a fascinating study on what consumers actually store in their wallet and the shifting uses for wallets over time see L. Cooper (1999, pp. 87-93). Financial objects in wallets include: receipts, money (cash and coins), loyalty cards, debit cards, bank cards, credit cards, charge (smart cards) and checks. Non-financial objects include: membership cards, business cards, drivers license, telephone numbers, ID cards, postage stamps, lottery tickets, coupons, photographs, national insurance card, medical prescriptions, train tickets and a calendar. While the magnetic-stripe card has successfully acted to reduce the amount of money people carry, the technology has attracted other countless product innovations. Unfortunately, the reality is that wallets and purses are still bulging but not with money, instead with numerous plastic cards. It is not unusual to be held up in a shopping queue while someone is shuffling through their collection of magnetic-stripe cards searching for the right one to make their transaction. It is not out of the ordinary for a consumer to possess a separate ATM savings card, several credit cards, a frequent flyer card, a phone card, a discounted travel card, an employee identification card, a library photocopy card, a driver’s license and several different loyalty retail cards (Cox, 1997, pp. 28-31).

There are presently several billion magnetic-stripe cards in circulation in the United States alone (Blank, 2007). This is testament to the increase in consumer acceptance of card technology and the marketing efforts of large corporations to sell the benefits of the card. In addressing the issue of the magnetic-stripe card taking the form of an electronic purse, Peter Harrop (1992, p. 227) describes the main applications other than the FTC. He makes the observation that: “[s]o far, payphones are the commonest application… Mass transit, particularly ‘stored-value tickets’ for trains and buses, is the second largest application… Prepayment cards are widely used for taxis, road tolls, parking [Figure 3], vending, payment in canteens and small shops, purchase of electricity and gas at the home meter, in launderettes and many other applications.”

The Plastag Corporation, a card manufacturer approved by MasterCard and Cash Station have put together an imaginative range of product solutions. While producing the standard line of bank cards and blank cards, they are also the largest supplier of casino cards in the U.S. Other Plastag (1998) products include:

“- pre-paid phone cards: phone cards are one of the most popular and effective promotional tools to build traffic in a business

It is important to keep in mind that not all applications require the same level of security as the FTC- it all depends on the application. For instance, paper bus and rail travel tickets featuring a magnetic-stripe are highly negotiable (i.e. they do not require a PIN or user ID and can be interchanged between persons).

Case 1: Magnetic-stripe Cards for Financial Transactions

Some may have thought it more valuable to relate financial services to smart cards but the reality is that widespread usage of smart cards by most banks is still some time away, especially in North America. “…Less than 5% of smart cards worldwide are issued by banks… Mass rollout of smart cards is years away because of the cost to convert magnetic-strip credit, debit and ATM card systems to chip technology” (Bank Sys., 1997, p. 21). Presently, it is the plastic embossed card with the magnetic stripe and signature that has permeated most countries around the world. The card is used to perform transactions for various types of electronic funds transfer systems (EFTS): ATMs, CDs (cash dispensers), EFTPOS and remote banking. As one report noted these ‘profound changes’ linked for the first time the consumer directly to the computer. Prior to magnetic-stripe cards, consumers depended upon the services of an intermediary at the counter but now the consumer is able to perform operations that were previously conducted by a bank clerk (OECD, 1989, p. vi).

Magnetic-stripe cards have been able to offer the dual function of paper-based and paper-less transactions. This is important because it has enabled the cardholder the ability not only to withdraw or transfer cash but also to use ‘plastic money’ with the same card. For instance, in Australia the St George Bank Freedom MultiAccess Visa magnetic-stripe card (with hologram) allows the cardholder to visit ATM machines to withdraw cash using a PIN and also to purchase goods and services by credit using the cardholder’s signature. International credit card corporations like American Express (AMEX), Bank Americard, Cartasi and Diners Club which are offering credit-based financial services are still using magnetic-stripe cards with embossed writing and signature though they have signaled their intention to migrate cards over time. While this type of system is obviously convenient for the cardholder, questions are continually being raised about the vulnerability of the cards to fraud and theft. More recently in Australia, credit card companies are linking PINs to cardholder accounts to eliminate the possibility of fraudsters giving false signatures at point of sale.

Are Magnetic-stripe Cards Outdated Technology?

While most banks and financial institutions still utilize magnetic-stripe on their customer FTCs, particularly in the U.S., all of the banks in France are reaping the benefits of smart card. “All bankcards in France have a chip imbedded in them... When a French cardholder makes a purchase, the transaction is processed at the point of service using the chip and not the magnetic stripe” (Ayer & McKenna, 1997, p. 50).The Dutch have followed the example of the French. Each of the French chip cards carry a payment application known as B0’. “Dutch banks are poised to become the first in the world to introduce computer smart cards on a nationwide scale this year, eventually giving 15 million people the possibility of living without cash” (van Grinsven, 1996, p. 32).

Smart cards have always been a dormant threat to magnetic-stripe but in most countries it has taken until the year 2000 for noticeable migration from the magnetic-stripe card to the smart card to happen. It took almost 40 years to distribute plastic payment cards widely; it will probably take another 10 years before consumers worldwide are comfortable with the multiapplication smart card. Even though the card is a more secure technology enabling the reduction of fraud, many consumers are concerned with the card’s potential uses. It is the information centralization to one unique ID per person that consumers find uncomfortable. Some banks have already issued multiple application cards but consumers still fear security breaches.

Many banks have conducted feasibility studies on smart cards, either by doing secondary research or conducting pilot studies. They are presently, albeit seamless to the consumer, considering a transition between auto-ID devices. Customers are being supplied with hybrid cards until the migration from magnetic-stripe to smart cards is complete. In the former case, major banks across the world have begun marketing the smart card concept to consumers. In Australia for instance in 1997, the ANZ bank advertised the change from magnetic-stripe to smart card in full-page advertisements. One of these announcements is worth noting in full- a magnetic-stripe bankcard appears on the left page and a VISA card (with IC) on the right:

“October 1974. There it was in your letterbox. Whether you wanted it or not. A Bankcard. They all looked the same and their new owners likewise, were all treated the same. You were told where to use it and how much you could spend. All that changed. At ANZ it changed faster than most. To the point where you can now enjoy ANZ cards that not only provide credit… Cards that are aligned to your telecommunications company, your airline, and many other major companies you do business with on a daily basis. What next? Well, we’re currently at the forefront of smart card technology. Cards that use a microchip to record details of transactions and the balance on the card. Now won’t that be a nice change?” (The Australian, 1997, pp. 6-7).

Globally and throughout the 1990s banks conducted widespread smart card trials. In the U.S., Citibank and Chase Manhattan conducted a trial in 1997 covering New York City and some 50000 consumers. In 1993, National Westminster Bank and Midland Bank teamed up to trial the Mondex card in Swindon, including 40000 consumers. In the same year, the three largest credit card giants, Europay, MasterCard and Visa, implemented a global standard generally known as the EMV specification for smart card credit cards as they considered future migration paths (D.S. Gold, 1999). VISA was the first of the trio to distribute smart cards to their customers. American Express has also made inroads to developing EMV standard credit services. As Ayer and McKenna from VISA International reported (1997, p. 49), the EMV specification is truly global. It allows for the same terminal to accept a variety of payment cards. The aim is to expand the usefulness of payment cards to be able to do much more with them. In France there are even migrations occurring from smart bank cards developed in the 1980s to newer smart cards that adhere to the EMV standard and are based on the MULTOS operating system. Clearly this has been an unsettling period for banks and merchants as the costs to upgrade or replace existing ATM, EFTPOS, electronic cash registers, self-service fuel dispensers and other such terminals to make them smart card-ready are very high. Some have therefore chosen to remain with the magnetic-stripe technology for the interim and may well suffer for it later. In 2000, “Visa USA estimated it would cost $11.1 billion US to convert to smart cards in the United States alone, with $7 billion of that cost borne by merchants” (Blank, 2007).

From Electronic Purse to a Cashless Society

The first well-known electronic purse trial was conducted in Denmark, Noestved in 1992. The prepaid card system was called Danmønt A/S. The integrated circuit card (ICC) was used for the payment of small amount transactions such as at vending machines, payphones and transportation. By 1993 the card was rolled out to several large cities, and terminals were located at payphones, parking meters, kiosks and railway. In 1996, there were over 600,000 cards in circulation in 50 Danish cities. The next step for Danmønt was to introduce more sophisticated SVCs that could be used for bigger transactions that require more security. Danmønt’s strategy is to heighten consumer awareness and acceptance (PBS, 1998; Kaplan, 1996, pp. 150-152; Ferrari, 1998, pp. 196-197). In Portugal the SIBS (Sociedade Interbancaria de Servicos) have introduced the Multibanco electronic purse, yet another hybrid card incorporating a microprocessor for purse applications and magnetic-stripe for credit facilities. Close to 7000 smart card terminals have been introduced, the majority are off-line and about one-third can read both magnetic-stripe and smart card technology.

Two years after the Danmønt card was introduced, the Mondex card made its debut in the UK. “Enter electronic cash. The idea of digital money is simple enough: instead of storing value on paper, find a way to wrap it in a string of digits that’s more portable” (Ramo, 1998, p. 50). It is interesting to note that both Danmønt and Mondex were initiatives of large banks and telephone companies, although the two cards differ in principle. While Danmønt was designed for the payment of small transactions, Mondex was designed for the replacement of cash altogether. Mondex is also designed to leave an ‘untraceable’ audit trail. Since its inception in 1993, Mondex International (now a subsidiary of MasterCard International), has rapidly begun to roll-out trials all over the world. Mondex is being marketed as convenient for consumers and merchants. Some of its differentiators from ATM magnetic-stripe cards include: access to electronic money via public or private telephones, its ability to carry up to 5 currencies, an electronic wallet which allows card-to-card transactions, lock-code functions and instant statements. In the English town of Swindon, Godin writes (1995, p. 84), “...customers at the local McDonald’s buy Big Macs without touching a bank note; pub crawlers at Bass Taverns keep the taps running without tapping their wallets; and grocery shoppers pay for their provisions without currency changing hands. Citizens of Swindon... are participating in a pilot project testing Mondex, a smart card for dispensing digital cash.”

In 1994, Mondex was heralded as having the potential to become a global payment system and banks rushed to become a franchisee of the company. Mondex International has been hailed as the “evangelist” of the smart card world (Mitchell, 1996b, p. 52). More recently Mastercard International has reached an agreement to assume full ownership of Mondex International (Mei, 2001, p. 10). In Asia, HongKong Shanghai Bank along with Hang Seng Bank are serving Hong Kong, China, Singapore, Taiwan, Philippines and other surrounding countries with Mondex cards. Chase Manhattan and Wells Fargo along with the Royal Bank of Canada and the Canadian Imperial Bank of Commerce (CIBC) are trialing Mondex in the U.S. and Canada respectively. The Australian banks, National Australia Bank (NAB), Westpac, ANZ and Commonwealth Bank have paid ten million Australian dollars for their right to issue Mondex smart cards to consumers (Moreira, 1997, p. 45). Clearly, there is a movement away from the traditional magnetic-stripe FTC and a move towards both the electronic purse and electronic cash. The latter, of course, meaning a world without paper money- a cashless society.However, Mondex officials are still cautious about predicting the demise of cash completely. “They see digital money as an alternative to cash, another option among many options for consumers. Mondex has estimated that e-cash will carve out 30 percent of the payments market” (Godin, 1995, p. 97).

DigiCash is another company that is focused on delivering smart card solutions. The company established by David Chaum, a cryptography expert, is part of the consortium of firms that is involved in developing the electronic-wallet for the CAFE project (Conditional Access for Europe). A trial is already underway in the European Commission in Brussels. Other companies which are making their mark in the digital cash arena include: CyberCash, First Virtual, Michigan National, BankOne, CheckFree, CommerceNet, NetCash, Smart Cash, Telequip and NetMarket. These companies have developed solutions for purchasing goods and services over the Internet and conducting money transfers using electronic cash (Brands, 1995; Godin, 1995; and Essinger, 1999, ch. 10). Other well-known solutions include the Proton cash card (Proton, 1999) from Banksys in Belgium that is closely linked to American Express, and the Visa Cash card which is being tested by Visa International. Other schemes worth noting, which are trialling types of electronic purses include: Transcard, Quicklink & MasterCard (Australia), BalkanCard (Bulgaria), EltCard (Estonia), Avant (Finland), SEPT (France), Chip Knip (Holland), Eximsmart (Indonesia), LINK (Lebanon), Interpay (Netherlands), Bankaxept (Norway), SIBS (Portugal), NETS & CashCard (Singapore), UEPS (South Africa), SEMP (Spain), POSTCARD (Switzerland), FISC (Taiwan), VISA SVC (USA). This signifies a truly global reach.

According to Hendry (2007, pp. 144-162) the drawbacks of electronic purse schemes such as the Danish Danmønt, the Portuguese PMB, VisaCash and Mondex were three fold. Transaction times were usually felt to be slower taking up to several seconds, and a separate transaction was required for loading the card which was inconvenient for the user. In addition, there were problems with the cost of the schemes which were highly customized and proprietary in nature. When the Internet became a plausible avenue to making payments, either from a fixed or mobile device, electronic purse schemes became less popular as a longer term solution.

Biometrics and Beyond- Why carry cards at all?

“Automatic teller machines that identify users just by looking at them are expected to make PIN numbers and ATM cards obsolete” (Johnson, 1996, p. 11). Several systems have been developed by U.S. companies using iris identification. The Sensar Corporation, have already installed IrisIdent units in parts of North America and Asia. Citibank liked the idea so much, that it prematurely invested $US3 million into Sensar back in 1997. Nationwide Building Society, Britain’s largest mortgage lender is also trialing Sensar’s product in Britain, using NCR-built ATMs (Brown, 1998, p. 52). Oki Electric, a Japanese ATM manufacturer has agreed to buy at least $US35 million in Sensar products within 5 years (Fernandez, 1997, p.13). It is significant to note that even if biometric ATMs are phased in, that most banks will still continue to issue customers with some type of card device which will store the individual’s biometric. Diebold Incorporated have developed a multimodal biometric system for making transactions that incorporates both face and voice recognition. Using face recognition software by Visionics and voice-verification from Keyware Technologies, the face and voice must match an image and voice sample in a database for a customer to make a transaction (Belsie, 1997, p. 1; S. Gold, 1999). Even as far back as 1992 an Australian company, Bio Recognition, developed FingerScan for ATM transactions (Gora, 1992, p. 3). Biometric systems do seem to remove the need for remembering passwords and account numbers or carrying several cards with expiration dates etc, but they do require each customer to willingly provide a biometric (Wahab, Tan & Heng, 1999; Essick, 1998). The up-front cost of installing a biometric system is still not viable for most companies.

Biometrics is also more complex than solutions like RFID transponders. Recently, the advantages of transponders with respect to animal identification have been highlighted by print media. Some advocates of the technology say, if chip implants work for animals then they should also work for people. A number of respected scientists see it as a gradual progression to better efficiency and security. Others nervously acknowledge that mass trials are already technologically feasible. One of the earliest references to a type of auto-ID device that would herald in a cashless society was recorded in The New Westralian Banker, an official publication of the Australian Bank Employees Union. The article (Devereux, 1984, p. 5) was titled “1984 IS HERE!” and highlights a new system that supposedly does not require a bankcard or credit card or check or cash. “This is the crux of an experiment begun in Sweden starting March, 1983. 6,000 people have agreed to take part in this experiment. Each person involved has received a special mark (shot on to the relevant area with a special, painless ray gun) and is now marked for life (it doesn’t come off.) The mark is registered in a computer and will register in banks or wherever those marked decide to shop. The shopkeeper simply runs an electronic pen over the mark and it instantly sends that person’s number to a computer center from where all information of their transactions is sent to their bank. No money needs to be touched.”

The technology depicted suggests that some kind of human bar code trial occurred in Sweden. The technology did exist in 1984 to run this trial; however we have not been able to verify the authenticity of the content of the article. Whether Devereux had a wry sense of humor or the article content is true, still makes one wonder where the technology could be headed. In making reference to electronic cash, a Time Magazine reporter commented, “Your daughter can store the money any way she wants- on her laptop, on a debit card, even (in the not too distant future) on a chip implant under her skin” (Ramo, 1998, p.51). U.K. Professor Kevin Warwick, the first man to be implanted with a chip, has also said: “[i]n five years’ time, we will be able to do chip with all sorts of information on them. They could be used for money transfers [figure 5], medical records, passports, driving licenses, and loyalty cards. And if they are implanted they are impossible to steal. The potential is enormous” (Dennis, 1998, p. 2).

Case 2: Magnetic-stripe Cards in Transportation

Electronic Ticketing

Electronic ticketing systems based on magnetic-stripe technology are now widespread. Most tickets issued for a variety of transportation are made of a thin cardboard containing a magnetic-stripe down one side. They are known as ‘prepayment cards’. While these tickets are highly negotiable, consumers seem to be relatively unconcerned with loss or theft of a ticket. The cost to manufacture and purchase a ticket is relatively low compared to other card types. The movement away from traditional cardboard-only tickets only raised the price of a fare by a few cents and increased revenue manifold. In the U.S. the push toward transit fare automation began in 1972 when BART (Bay Area Rapid Transit) in the San Francisco Bay area was introduced. The process is as follows: “[t]ickets are dispensed by machines in stations that accept coins and bills. Ticket value is recorded on the mag stripe. When a rider enters the system the turnstile read-write unit records the place and time of entry. Upon exit, the turnstile computes and subtracts the price of the trip based on length of trip, and in some systems, the time of day” (Holmstrom, 1996, p. 1).

One of the successes of the introduction of magnetic-stripe ticketing is that it has allowed for the operation of a unified and standard metropolitan transport system. In Sydney, Australia, the State Rail Authority, the State Transit Authority and Ferry Authority have standardized their magnetic-stripe ticketing system. The Washington transit system also uses a similar set-up (Harrop, 1989, p. 342). Weekly or daily tickets can be purchased with ease and used for different types of transport (Figure 6). Consumers who purchase pre-paid tickets for multiple journeys usually receive price discounts (Todd, 1990). The short-comings of the ticket include that they are disposable (i.e. paper waste) and the ability to check whether an individual has purchased the right trip for their destination requires human intervention.

When standards for magnetic-stripe were being developed the International Air Transport Industry ensured that Track 2 was dedicated solely to air travel. Before any domestic or international flight, the traveler is issued with a boarding pass. Without this pass he or she cannot board the airplane even if their passport has been stamped by immigration. A boarding pass contains flight and seating information, the traveler’s name and flight class in the front and a magnetic stripe at the back. If a traveler has luggage to check-in bar code labels are attached to the bags so that they can be read later and routed to the correct destination (LaMoreaux, 1995, pp. 12-14). Today integrated RFID tags are used for baggage handling in many international airports, such as Hong Kong.

Loyalty Card Schemes

One of the biggest boosts to the magnetic-stripe card industry was the introduction of loyalty cards attached to air transportation especially. The idea has been around since the late 1980s but it picked up momentum in the late 1990s with frequent flyer card programs linked up with hotel chains and rental car companies. As far back as in 1987, the Airplus Company (initially backed by the top 13 European airlines) launched its loyalty card. It was one of the first companies to offer such a service but it found it very difficult to continue in the short-term as projected card targets were continually not met. The card was initially misunderstood by observers as a type of credit card but David Huemer (the CEO at the time) clearly stated that the service the card provided was the purchase of business travel for the frequent traveler. By 1988 Airplus was forced to change its strategy. The company restructured and successfully entered into the co-brand market directly featured on a host of Airplus-linked family cards like Austrian Airlines. Similarly in 1989, the Alitalia airline was offering a twenty per cent discount on full-fare domestic flights in Italy for Alicard cardholders. “Alicard, which is personalized and carries a magnetic stripe (the stripe is inactive and for ‘image’ purposes only), is being produced by a Rome-based subsidiary... Air industry observers consider Alitalia’s foray into the plastic card business part of an overall attempt to build itself an image as an innovator and improve its level of service” (Card World, 1990, p. 44).

The new loyalty card market is booming in that more and more consumers are subscribing to programs. Cross (1996, pp. 30-34) discusses how intelligent shoppers can benefit from loyalty programs. See the agreement between Mondex and beenz.com for loyalty points (D. Jones, 2000). Another example is the Australian loyalty card program called Ezy Rewards offers points for shopping at the Woolworths retailer, banking with the Commonwealth Bank, flying with Qantas, visiting particular entertainment venues and booking particular holiday packages. Under the guise of Club Miles, Frequent-Flyer, Fly-buys, Air Miles, The Travel Club, Reward Card, Premier Points, Executive Club and other so-named programs, consumers are rewarded for their loyalty by discounted or free flights, upgrades to flight class or airline lounges or hotel rooms etc. Companies from all types of industries are enjoying the co-branding concept, especially airlines that have teamed with large hotel chains, credit card corporations and telecommunications operators. What is important to highlight, however, is that the cost of these programs to airlines, hotels, and card companies is high and the return questionable. “The current process is inconvenient for the consumer, costly for the travel company to administer, and a nightmare for a corporate travel and finance department to manage” (Wesley & Wilkey, 1997, p. 201). In some cases, travel companies have abandoned loyalty programs altogether.

Are Smart Cards the Smart Choice for Contactless Ticketing?

At Airports and Checkpoints

Magnetic-stripe tickets have been successful in increasing commuter throughput at peak hour periods but many operators are concerned with the increasing means to counterfeit this media (Dinning, 1997, p. 186). For this reason, smart cards have been introduced to many transit systems all over the world. Since the Schengen Treaty, Amsterdam’s Schiphol airport has introduced a 100 million guilder smart card system for members of eight other European states that have agreed to scrap identity checks. “The plastic cards… allow for free movement for travelers through a special gate without having to show passports or ID cards… there are no photographs of travelers, passport numbers or any other safeguards in the card’s microchip… The treaty will provide free passage of citizens through France, the Netherlands, Germany, Spain, Portugal, Belgium, Luxemburg, Italy and Greece” (European, 1993, p. 3). More recently Iceland’s Keflavik International Airport upgraded its CCTV (closed circuit television) system with facial recognition technology to guard against terrorism, since its inception into the European Schengen Agreement (Lockie, 2001).

For Metropolitan Bus, Rail and Ferry Services

Among the most advanced is that established in Hong Kong. The consortium Creative Star has integrated the ticketing system for trains, buses, taxis, trams and ferries. The Octopus Card (Kwok, 2001, p. A4) is used to collect payment for taxi fares and other transport services (Wallis, 2001, p. B5). Consumers are charged a small levy for using the card to offset overall costs. This is how Creative Star as the service provider makes money and how merchants can recover their costs for buying specialized readers (Chan, 2001, p. 6). The contactless card allows commuters to pass through turnstiles without having to insert it in a reader. The consumer has the choice between a personalized and non-personalized card (Chau & Poon, 2003).

In the U.K., Transys began to develop the Oyster Card for London Transport (LT) in the 1990s. It was proposed that (Jones, 1998, p. 4): “[a]utomatic gating will be extended to all the London Underground stations and existing automatic gates will be upgraded to read smart cards. Electronic ticketing machines will be introduced in all buses operating in London. Transys will also take over the operation of London Transport’s Pass Agent ticket retailing network operated confectioners, newsagents and tobacconists and collect revenue from them. Some 2,300 retail outlets will have the equipment for issuing smart cards.” Today we know this scheme as the Oyster Card (London Transport, 2008). An Oyster card can store up to £90 of credit, which can on bus, Tube, trams, DLR, London Overground and some National Rail services in London.

The Washington Metropolitan Area Transit Authority (WMATA) trialed contactless smart cards in 1995. The ‘Go Card’ as it was named, could also be used to pay for commuter parking. German Autobahns used the chip-ticket system from about the mid-1990s (Wenter, 1994, pp. 50-54). The Tapei City government implemented a Mass Rapid Transport (MRT) system using contactless smart cards for payment on buses, the subway and a number of car parks. The MAPS concept called for the ability to pay for all transit purchases from bus fairs to parking fees and tolls (Cunningham, 1993, pp. 021-025). Additionally, smart transit cards have been used in agreement with universities and other applications.

The smart card is not only convenient for the consumer but provides a wealth of knowledge for operators in terms of resource allocation and transport network optimization (Blythe, 1996; Blythe & Holland 1998). For the advantages and disadvantages of smart card fare collection media refer to Okine and Shen (1995, pp. 524-525). Zlatinov (2001, pp. 35-36) reported on the next generation of transit cards. Readers linked to an information system can gather important statistical data that can assist with planning present and future transport services. For example, an operator has the ability to count the number of passengers that use particular bus, train and ferry routes at particular times of the day.

Road Tolling Applications

In Singapore, this idea has been taken one step further with the fully operational ERP (Electronic Road Pricing) system and contact-based electronic purse ‘CashCard’ (LTA, 2008). Drivers do not only go through toll gates without stopping but information collected allows operators to locate congested areas at peak traffic times, plan for new roads or redirect traffic through other routes (Figure 7). The RFID-based system even has the capability to charge drivers according to the route they have taken, to ensure a smooth flow of traffic (Kristoffy, 1999). Drivers who do not wish to pay higher levies may use non-direct routes which take longer to get them to their destination. For an overview of RFID toll applications refer to Gerdeman (1995, ch. XI). This type of system has enormous implications for congested and polluted cities such as Athens in Greece. In London in the United Kingdom instead of RFID a network of camera sites monitors every entrance and exit to the Congestion Charging Zone (CCZ). High quality digital images are taken of vehicles through a process called Automatic Number Plate Recognition (ANPR) which reads and records each number plate and charges vehicle registrations accordingly.

In understanding the flow of traffic, new bus routes could be setup to encourage people to take public transport instead of their own car. The terms ‘smart city’, ‘smart vehicles’, ‘smart roads’ are beginning to surface in transport and telematics. Komanecky & Claus (1991), and Gerdeman (1995, ch. XII) refer to this type of RFID application as an Intelligent Vehicle Highway System (IVHS). Choi et al. (1995) discuss a real-time moving automotive vehicle identification system (AVIS) that uses bar codes at toll gates to measure city traffic. In the Italian city of Turin, the public transport company ordered a Confident RFID system (TagMaster AB) for its 900 buses, 300 trams and drivers. “[T]he ID tags in the system will also make it possible to get information about mileage, fuel consumption and service interval status of the vehicles” (M. Marsh, 1998, p. 1).

Boarding Passes and the Airline Industry

In October 1995, at the Passenger Services Conference, a smart card subcommittee was established to develop an airline industry smart card standard. Problems envisaged with electronic ticketing, namely how to identify a passenger quickly without a paper boarding pass, led to the formation of the subcommittee. In Australia QANTAS allows for ‘e-check ins’ for domestic flights. A traveler is required to use his/her credit card at a check-in kiosk at the airport and a boarding pass is provided after the consumer enters their itinerary details. Flight times, seat changes and baggage check-in are all automated through this process. Delta Airlines, Lufthansa and Air France are now using IATA standard smart cards. The results of the Smart Card Subcommittee were IATA resolution 791 and ATA resolution 20.204- ‘Specifications for Airline Industry Integrated Circuit Cards (ICC)’. The resolution made effective in 1997, means that cards are interoperable at gates which have upgraded their read/write hardware. It is expected that most of the airline cards will be co-branded cards. Credit card companies like Visa, MasterCard and American Express showed immediate interest. For a list of airlines that provide an e-ticket services refer to the IATA web site (IATA, 1999). Delta Airlines have issued smart cards to frequent flyers between New York, Boston and Washington.[iii] The contactless chip card is swiped by the passenger at the boarding gate for authorization to board the plane. The card not only acts as the ticket but serves the other functions of a Frequent Flyer Card and credit card.

Lufthansa have already issued hundreds of thousands of smart cards to its frequent flyers and Senator cardholders. Known as the ChipCard, the card is used on all German domestic flights as well as from London and Paris. The card is truly a multiapplication card, as it can be used for making telephone calls in Germany, as a credit card, and Air Travel Card, a ‘Miles and More’ frequent flyer card, a membership card for airport lounges, and a boarding authority for passengers. Different from the Delta Airlines frequent flyer card, the ChipCard is both contact and contactless. When boarding the passenger does not need to insert the card in a reader but simply walk past the RF reader near the gate. Air France also records the passenger itinerary on the ATB Pectab Gemplus smart card.

Just as magnetic-stripe cards can be stolen, so can smart cards. For that reason, it is possible that an unauthorized person may be allowed to travel accidentally or by fraudulent intent. After the terrorist attacks of September 11, 2001, and numerous other foiled attempts to down passenger airliners in the UK and US, numerous governments have either investigated or implemented biometric schemes or electronic Passports known as ePassports. Some authorities around the world have even integrated smart cards with biometrics (Halpin, 1999). As the traveler passes through immigration, he/she must insert a card into a reader at the first gate. The information stored on the card is read and verified. Different airports around the world are using different human characteristics, varying from fingerprints, hand geometry or a combination of both. The sample taken is then matched with a record in the database and the image on the card. If there is an exact match, the passenger is allowed to travel. Such a system is being promoted by IATA and is already in use in Australia, Belgium, Canada, France, Germany, Hong Kong, Netherlands, Switzerland and Taiwan and the U.S.

CONCLUSION

Magnetic-stripe cards are now considered a mature auto-ID technique, a catalyst for the highly complex physical and logical infrastructural interconnectivity that exists in the banking sector today. While the technology itself has not undergone revolutionary changes to its make-up, simple incremental innovations have been introduced in a bid to minimize fraudulent activities, especially where credit cards are concerned (Berghel, 2007). The predicted demise of the magnetic-stripe card in the mid-to-late 1980s did not eventuate. Cost and first-to-market principles seem to have overridden any attempt for the smart card to overtake the magnetic-stripe card in market share, despite its superiority in terms of security and functionality. While magnetic-stripe card fraud continues to be a global problem for credit card companies especially, the transition to another card technology is riddled with obstacles. Namely, transitioning requires a change in physical infrastructure, a shift in consumer mindset, agreement in card standardization focused on security and interoperability, all of which seem too difficult to institute. For now at least, the industry seems complacent, willing to live with the multi-billion dollar problem of fraud rather than to make radical changes. Outside the financial sector, magnetic-stripe cards have prospered in terms of their utility, effectiveness and versatility. They have acted primarily to verify a cardholder’s identity, linking an embossed number or barcode also present on the card to specific applications. While we can lay claim to the fact that we are now living in a relatively cash-less society, today’s wallets and purses are still bulging, only now bulging with strips of plastic, rather than strips of reinforced paper.

Yan, G., Paradi, J. C., & Bhargava, S. (1997). Banking on the Internet and its applications. Paper presented at the IEEE Proceedings of the Thirtieth Hawaii International Conference on System Sciences.

[i] Jones (1987a) writes on the secret Australian government plan to push ID on citizens; Walker (1987) a feature article on the Australia Card debate; Evans (1987) highlights just how invasive the Card would become interlinking all facets of life; Collier & Hill (1987) present the power of the government to introduce the ID card; Walsh (1987) on the demise of the card; Perkins (1987); Fewster (1986) on the potential ID card non-compliance penalties; Cumming (1986) on the declining support for Australia’s proposed national ID card; Glynn (1987); Dawes’ (1986) letter to the editor discussing how one number would reveal all; Ransom’s (1986) letter to the editor alleging that the ID card is a fraud on the people; and Hurry’s (1987) advertisement about the hidden clauses of the proposed Australia Card, in the interest of the community. Apart from all the media press, the government also published a number of reports on the topic of an Australia Card, for instance, Commonwealth Department of Health (1987) and Joint Select Committee (1986). A relevant research paper by Graham (1990) is on bureaucratic politics and the Australia Card as well as a NSW Combined Community Legal Centres Group (1988) submission to the Senate on a national identification system for Australia. For a short summary of the bureaucratic issues with the Australia Card see Martin et al. (1997, pp. 27-30). For an American perspective on the national ID card debate see Eaton (1986). While an Australian citizen card did not make an appearance, a tax file number (TFN) eventually did in its place (Clarke 1991). See Hogarth (1997, p. 4); Parliament of the Commonwealth of Australia (1988) on the feasibility of a national ID scheme (i.e. the TFN); Davies (1992, ch. 3) on the government versus the people; and Clarke (1993) on why people are scared of the public sector. The media added fuel to the debate by reporting on cases that were related to social security fraud and stolen identities which caused some consumer groups to lobby against the idea of a card altogether. Yet what most consumer groups did not realize is that they were really arguing against an identity number and not the card itself. While an Australian citizen card did not make an appearance, a tax file number (TFN) eventually did in its place.

[iii] See Economist (1995) for the notion of “ticketless” air travel using smart card media. It should be noted that articles written before the recent spate of terrorist attacks are a little naïve in terms of how air travel can be made more convenient without the traveler having to go through so many individual checkpoints to board a plane. Compare Economist (1995) with Watson (2001b) who writes: “September’s attacks added a new dimension to airline security.”